London Stock Exchange Was 'Under Major Cyberattack' During Linux Switch

An anonymous reader writes with this excerpt from Computerworld UK: "The London Stock Exchange's new open source trading system may have been hacked last year, according to a report. The alleged attack came as the LSE began the switch over to the Linux-based systems, according to the dates referred to in the Times newspaper. The continued threat of cyber attack has resulted in the LSE keeping a close dialogue with British security services, which this year branded cyber attacks as one of the biggest threats to the country. There were major problems on the exchange on 24 August, when stock prices of five large companies collapsed."

Pissed off crackers?

[Centurix]

Part of thinks that these guys may have had easy access to the stock exchange system through whatever backdoor they had. Closing it then pissed them off so they went on the attack.

Re:Pissed off crackers?

[SimonInOz]

Let's see - the London Stock Exchange swapped to Linux based software. It changed FROM Microsoft based software. (TradElec Windows-based C# and .NET programs, apparently).

And there was a major cyber attack during the changeover.

Let the conspiracy theories begin ...

Re:Pissed off crackers?

[gbjbaanb]

not necessarily - they might have thought it was the ideal "opportunity moment" - attack the system when they're undergoing a transition and not only might they get away undetected, but they might also cause more damage than before (ie with servers turned off ready to be replaced with the new software, the capacity would be reduced).

It isn't necessarily Microsoft fanboi hackers trying to discredit the migration to Linux (and getting their dates cocked up)

Re:FUD

[mangu]

'may have been' another piece of MS-sponsored FUD?

Of course, since everybody here knows Linux systems do not get attacked

Yes, at least that's the official Microsoft version. There are no viruses for Linux because no one uses it.

Re:Internet Connected Exchanges?!

[pasv]

If Stuxnet taught us anything is that even systems not connected directly to the internet are still very much vulnerable. Spear phishing and other targeted attacks towards the maintainers/developers of those systems are just as effective if not more so than attacking the system head-on. I'll take the cape of Captain Obvious here but anyone funding an attack sophisticated enough to pull off a Stuxnet-like payload is more than likely well invested in the return of said attack. But of course no one could ever earn any money hacking a stock exchange system right? ;)

Re:Internet Connected Exchanges?!

[funkatron]

Yeah, it would be slightly inconvenient but have some perspective, we're talking about one little service industry here. In terms of importance it ranks well below things like power, water, communications, shopping, manufacturing, research. A stuxnet aimed at any of those would be a whole lot more damaging.

Re:Linux Fags

[jimicus]

The question I would have is this: Would the MS system have held better?

The answer is "it depends".

Mostly, it depends on who's doing the hacking and who's managing the system. If it's a bunch of script kiddies or some bot which tries a number of well-known hacks then gives up and the system is competently managed, chances are neither would be particularly insecure.

If the system is poorly managed - be it Windows or Linux - chances are it's not going to take much effort to get in and some kid following a script without really understanding it could do it.

Where things get interesting (and impossible to discuss meaningfully without a better understanding of the systems themselves) is when you have competent, well-funded IT management (which I would hope any stock exchange would) and competent, well-funded attackers who are focused on a single goal (which is entirely possible when you're talking about a high-profile victim like this).

article omits very important point.

[seeker_1us]

From one of the comments

This article is incredibly short on details and clarity. The systems 'compromised' appear to have still been running .NET, but the heading seems to just want to throw Linux and Risk into the same sentence. The complete lack of facts makes this seem like FUD.

"A half truth is a whole lie" ---Yiddish proverb.

Love the FUD!

[erroneus]

This is just awesome. Just when you would think it would be impossible to spin an attack on a major Microsoft based trading system, they omit Microsoft, insert Linux and speak of the dreaded cyberattack.

I have to wonder who and why. Anyone have any background on the author and the publication's history on Linux and Windows stories?

Re:LSE not on the Linux platform yet

[Anonymous Coward]

They focused on Linux because a story about .net being attacked isn't news worthy. On the other hand, framing it such that linux may be in the spot light means people are chattering about linux and their story. This seriousl,y sounds like ms sponsored FUD.

Re:article omits very important point.

[h4rr4r]

So how much is MS paying for that spin?
Their trading system could not meet latency requirements and now they need someway to save face.